Sun Tzu 2.0: Is CyberWar the new Warfare?

QinChineseQuotesArtofWarA640x640.jpg

 

For better or worse, the multitude of networks that help keep our world interconnected is a much different place today than it was in the past. Paradoxically, the networks that provide users with a wealth of information, transactional services and the like have also been used as a battlefield to disrupt our everyday lifestyle. From obtaining general information to managing online financial portfolios to purchasing flight tickets, there has been a groundswell of disruption to access these channels.

This year alone, these major cyber events have taken place:

January 2015: Pro Russian Hackers claim success in taking down German Chancellor’s website.

February 2015: Dutch government websites go down for more than 12 hours and cite DDoS attacks as the cause.

March2015: South Korea issues a report blaming North Korea for cyber-attacks on nuclear and water power plants.

April 2015: Group Anonymous kicks off #OpIsrael by attacking all Israeli-owned cyber assets.

May 2015: Germany’s Parliament confirms sophisticated cyber-attacks on their institution.

June 2015: Security researchers reveal that Southeast Asian Governments were hit by Operation Lotus Blossom. These attacks included sophisticated intrusions.

July 2015: A major US air carrier and stock exchange stops operating for several hours citing operational problems; however, numerous questions linger about the severity and consequences of such events.

Cyberwar and its ramifications have been debated for some time and the issue has been wrought with controversy. Few would argue that cyber-attacks are not prevalent in cyberspace. However, does it amount to a type of warfare? Are we in a cyberwar?

Let’s break this down by drawing parallels from a treatise by 6th century military general, Sun Tzu, who authored one of the most definitive handbooks on warfare, “The Art of War.” His writings have been studied throughout the ages by professional militaries and can used to not only answer the question of whether or not we are in a cyberwar, but how one can fight a cyber-battle.

There are 13 elements that Sun Tzu uses to define warfare. Here are five noteworthy elements that relate to our question about cyberwar.

Element 1: The Army on the March

Sun Tzu suggests that for there to be a war, there needs to be an army on the march. This idea stems from the idea that to gain geo-political advantage, there must be an adversary to march against you.

This notion of coordination and focus is applicable to modern day cyber-attacks. And it is accepted in risk circles that there are a number of motives, which can contribute to these mass, focused attacks. One example of this is Operation Ababil. This cyber-attack lasted close to two years from 2012-2014 and targeted banks and financial institutions in the US It was purported to have originated from Iranian-backed cyber attackers who wanted to exert geo-political pressure on Western countries to ease sanctions.

Other examples exist such as the much heralded, attacks on Israel during various Gaza conflicts and those documented between Russia and the Ukraine and Russia and Georgia. Just like the Cold War was an abstract concept in which invisible hands seemed to drive motives and influence, the notion of today’s cyberwar has transcended, in many cases, to nation-state sponsorship.

Element 2: Variation of Tactics

Sun Tzu suggests that for warfare to exist the intended target must stay the same. However, tactics will change to gain more effect or efficacy. Sun Tzu also states that until the aggressor has achieved their results or has lost the will to fight, they will continue to fight endlessly and will randomize tactics within the battles themselves.

One can ask, does the current world of multi-vectored attacks seem more like warfare or a schoolyard brawl? If it were a brawl, one could assume that when emotions cooled, sounder times would prevail. However, if it is warfare, according to Sun Tzu, the attacks pervade. And right now, we see no end of cyber-attacks in sight. 

Element 3: The Use of Intelligence

Sun Tzu suggests the adversary who gains unique insight into their adversaries’ weaknesses and strengths holds the advantage in the battle therein. 

During the two decades I’ve spent in the information security space, there is no precedent, requiring companies to arm themselves with ‘intelligence.’ In the past, the term intelligence was largely reserved for nation-state activities to further knowledge in pursuit of geo-political gain. However, there is an ever increasing, call for companies to be armed with unique information on changing threats and retain that capability within their companies.

Element 4: Illusion vs. Reality

According to Sun Tzu, wars are won by perception alone. He suggests that the key in both waging war and winning war is in the finer elements of destroying an adversary’s will to fight. He also suggests that kinetic engagement is often a futile effort in destroying the will of an adversary. The victor will be he who plants the perception in the minds of the combatants that their resistance will be futile. This is imperative.

This is an essential part of warfare – combatants create psychological messaging and leverage alliances and influencers to conduct warfare. The resulting ‘image’ created from those efforts are sometimes far from the reality, yet necessary for adversaries to win wars. Given this, we have witnessed concerted efforts by today’s cyber-attackers (Anonymous Operations, LulzSec, and many more) to exact a mental toll on their intended victims even before a single attack is hurled.

Often times even just the threat of attacks can result in the aggressor gaining their concessions from their targeted victims. These efforts are now spilling over to geo-political threats on everything from the financial sectors to critical infrastructure.

Element 5: Laying Plans

Sun Tzu argues that to be the victor in warfare one must lay plans for the victory. He suggests that the most successful defense and offense of a military is achieved first through professional planning.

Before our eyes we are witnessing a dramatic change in nation-states standing up legions of newly organized Cyber warfare centers, which are designed to organize, train and equip the next generation warrior. Moreover, there is an equally impressive effort on behalf of transnational actors (e.g. Al-Qaida, ISIS, Group Anonymous, and numerous other groups) who don’t call a nation-state home. Nevertheless, they have built impressive capabilities to exact their will on others through training camps and fielding armories of newly developed weapons. Today’s threat landscape is moving quickly with offensive weapons being fielded routinely as well as innovative new ways to exploit old vulnerabilities via the use of professional planning and training.

The changes in the threat landscape and the documented attacks are more akin to warfare than random acts of thuggery. Although many of these attacks are not directed in a coordinated manner with a central authority, tactics and means often lead like-minded organizations to band together. Could this possibly be the next step in the evolution of this type of warfare?

Should this environment manifest to an all-out warfare, serious questions may arise. How capable are we to protect human safety in transportation systems? Can the integrity of our financial sector be preserved? Will the quality and the sanctity of our way of life remain preserved by of our political and governing systems? If we are not capable – what measures need to be implemented in order to protect these interests? 

Hopefully, we can abate these threats and take back the upper hand in this electronic “Sun Tzu 2.0” warfare.
Ein News: http://bit.ly/1TBm6So

 

« Hacking Critical Infrastructure: How-To Guide
When Your White Hat Is Really a Black Hat »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

SharkGate

SharkGate

SharGate provide a cloud-based website security solution to protect websites from being hacked.

Cyber Risk Agency

Cyber Risk Agency

Cyber Risk Agency is a cybersecurity consulting firm specializing in managing cyber risks for SMEs.

HDI Global SE

HDI Global SE

HDI Global SE provides customised insurance solutions for industrial and commercial clients worldwide including Cyber Liability insurance.

Center for Strategic Cyberspace & International Studies (CSCIS)

Center for Strategic Cyberspace & International Studies (CSCIS)

CSCIS seeks to advance global cyberspace security and prosperity by providing strategic insights for cyberspace and policy solutions to decision makers.

Recorded Future

Recorded Future

Recorded Future arms security teams with threat intelligence powered by patented machine learning to lower risk.

Resilience First

Resilience First

Resilience First is a not-for-profit organisation, led and funded by business to strengthen collective business resilience in all areas, including cyber security.

_cyel

_cyel

_cyel is introducing a new cybersecurity strategy: not a new generation of patches and firewalls, but moving target security – we take away the targets. Without replacing your existing system.

Accertify

Accertify

Accertify is a leading provider of fraud prevention, chargeback management, and payment gateway solutions.

CyberInsureOne

CyberInsureOne

At CyberInsureOne, we break down the complex world of cyber insurance, and connect you with providers that can give you and your company peace of mind.

CPP Group UK

CPP Group UK

CPP Group UK develops products to help insurers add further value to their products and services through its innovative suite of new products in FinTech, InsurTech and cyber security.

Dell Technologies Capital

Dell Technologies Capital

At Dell Technologies Capital we lead investment in disruptive, early-stage startups in enterprise and cloud infrastructure.

Anthony Timbers LLC

Anthony Timbers LLC

Anthony Timbers is a cybersecurity consulting and penetration testing firm providing services to the Federal and Commercial sectors nationwide.

Inversion6

Inversion6

Inversion6 (formerly MRK Technologies) is a cybersecurity risk management provider that offers custom security solutions.

Aardwolf Security

Aardwolf Security

Aardwolf Security specialise in penetration testing to the highest standards set out by OWASP. We ensure complete client satisfaction and aftercare.

Mindcore Technologies

Mindcore Technologies

Mindcore provide cyber security services, managed IT services and IT consulting services to businesses in NJ, FL, and throughout the United States.

Cyber Unicorns

Cyber Unicorns

Cyber Unicorns is a cyber security consultancy created to help drive cyber security outcomes in the small to medium-sized business space.